@humanwhocodes/module-importer

Release historydanger

Only two releases exist, both in August 2022, with no release in about four years. This materially raises maintenance and abandonment risk.

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable.

Lifecycle scriptscaution

A prepare install-time script adds execution during installation, creating a modest supply-chain and reproducibility concern even though no malicious behavior is established here.

Repo commit activitycaution

There were no commits or active maintainers in the last three months, indicating weak current development activity, although the repository was pushed in February 2025.

Repo toolingcaution

The project uses TypeScript, Rollup, and npm scripts, but no security-scanning tooling was detected. The build setup is credible, with a minor security-hygiene gap.